Preventing Cross Site Request Forgery
The browser security model, where a session cookie is globally among all windows/tabs, allows for a request to be made with the privileges of the logged in user.
Where Cross Site Scripting (XSS) is making code delivered through one place (be it a malicious site, email, text message, downloaded file, and so on), execute on another site, Cross Site Request Forgery is the act of making a request from one place (again either a malicious site or otherwise) to another site that a user is logged into - that is where they have an open HTTP Session.
In short, XSS is running malicious code on another site and CSRF is making a request to another site that executes an action on a logged in users behalf.
In this recipe, we're going to secure a server against CSRF attacks.
Getting ready
We're going to create a simple server that manages "Employee Payment Profile" updates, and an adversarial server that uses CSRF to change where an employee's hypothetical salary is sent...
